PT-2009-6494 · Alienvault · Alienvault Ossim

Nahuel Grisolía · Published 2009-12-21 · Updated 2017-08-17 · CVE-2009-4372

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions AlienVault Open Source Security Information Management (OSSIM) versions prior to 2.1.5-4

Description The issue allows remote attackers to execute arbitrary commands via shell metacharacters in the uniqueid parameter to API endpoints such as "wcl.php", "storage graphs.php", "storage graphs2.php", "storage graphs3.php", and "storage graphs4.php" in the sem/ directory.

Recommendations For AlienVault Open Source Security Information Management (OSSIM) versions prior to 2.1.5-4, consider updating to version 2.1.5-4 or later to resolve the issue. As a temporary workaround, restrict access to the vulnerable API endpoints in the sem/ directory to minimize the risk of exploitation. Avoid using the uniqueid parameter in the affected API endpoints until the issue is resolved.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2009-4372

Affected Products

Alienvault Ossim

References · 14

• 🔥 http://cybsec.com/vuln/OSSIM_2_1_5_Remote_Command_Execution.pdf · Exploit
• 🔥 http://exploit-db.com/exploits/10480 · Exploit
• 🔥 https://exploit-db.com/exploits/10480 · Exploit
• 🔥 http://securityfocus.com/bid/37375 · Exploit
• 🔥 http://alienvault.com/community.php?section=News · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-4372 · Security Note
• http://secunia.com/advisories/37727 · Vendor Advisory
• http://osvdb.org/61153 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/54843 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4372 · Note
• http://osvdb.org/61151 · Note
• http://osvdb.org/61155 · Note
• http://osvdb.org/61154 · Note
• http://osvdb.org/61152 · Note